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In this report we discuss the insecurity with present implementations of the Ekert protocol for 
quantum-key distribution based on the Wigner Inequality. We propose a modified version of this 
inequality which guarantees safe quantum-key distribution. 
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Following the first proposal by Bennett and Brassard 
PJ and the later introduction of the Ekert protocol invok- 
ing entangled states Q , various systems of quantum key 
distribution (QKD) have been implemented and tested 
by groups around the world, turning QKD into the most 
advanced application in quantum information science. 

QKD offers the possibility that two remote parties, 
conventionally called Alice and Bob, exchange a secret 
random key to implement a secure encryption-decryption 
algorithm, without meeting Q. 0- Q . QKD provides a 
significant advantage over the public-key cryptography 
because the security of the distributed key relies on the 
laws of quantum physics 0. 0- Q- i- e - the wave packet 
collapse prohibits gaining information from a quantum 
channel without disturbing it. Indeed, any attempt by a 
third party (Eve) to obtain information about the key is 
detected. 

Two main goals underly the implementation of QKD 
schemes. One is to create and preserve authentic quan- 
tum channels against decoherence effects induced by any 
interaction with the environment [5|, eventually reduc- 
ing or even destroying invulnerability of quantum chan- 
nels against Eve's attack. The other is to provide a true 
guarantee of absolute security against any possible eaves- 
dropping attack i.e. the security is not simply based on 
technological feasibility. 

Scientists are currently usingone of twophoton sources 
for practical QKD, faint lasers [H. Irj F?l 111. l9llTo| or sponta- 
neous parametric down-conversion to gen erate entangled 
photon states (SPDC) [3 13 13 III El 

Both schemes have disadvantages, although Brassard 
et al. |3] proved theoretically that QKD schemes based 
on entangled photons offer enhanced performance and se- 
curity relative to schemes based on weak coherent pulses. 
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FIG. 1: QKD set-up: polarization entangled photons gen- 
erated by SPDC are directed to the two parties (Alice and 
Bob). The bit sequence of the key is obtained by means of 
polarization sensitive synchronized measurements performed 
by Alice and Bob according to a specific QKD protocol. 



In fact, entangled states allow a further test of secu- 
rity based on the completeness of quantum mechanics; 
in other words, the Ekert protocol exploits either the 
Clauser-Horne-Shimony-Holt (CHSH) 0] or the Wigner 
inequality |l3j | as an ultimate test of eavesdropping at- 
tack. 

Wigner's inequality was originally intended to pro- 
vide an easier but as equally reliable eavesdropping check 
as the CHSH test in implementing the Ekert protocol. 
In this report we disclose the weakness of the Wigner in- 
equality as a security test when Eve has the total control 
of quantum channels. 

In Fig. 1 we depict a typical scheme for QKD by means 
of entangled photons. QKD performed by pure entangled 
states relies on the realization of two quantum-correlated 
optical channels yielding quasi single-photon polarization 
states. Alice's measurement of the polarization of a pho- 
ton of the pair, automatically projects Bob's photon into 
a defined polarization state, and reversibility. Alice's 
and Bob's detection apparatuses are built using polar- 
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ization analyzer systems (PAS), polarizing beam split- 
ters (PBS), detectors {+a, —a, +b, — b), data storage 
systems (computers), and synchronization systems. 

Consider, as an example, type II parametric down- 
conversion entangled states [l7|, where the output two- 
photon states are a quantum superposition of orthogo- 
nally polarized photons, i.e. in the singlet state 
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Without any loss of generality, a particular QKD pro- 
cedure can be described by the transformations, T z ,with 
z = A, B, on the polarization state of a photon, e.g. a 
rotation of angles a a and a B respectively according to 

T z \H Z ) = cosa z \H Z ) + sino z \V Z ) , 
T Z \V Z ) = sina z \H z ) - cosa z \V z ) . 

We assume ideal PBS in channel z transmitting pho- 
tons in the state \H Z ) towards detectors + z and reflecting 
photons in the state \V Z ) towards detector — z . 

The joint probabilities of each possible pair of detectors 
firing due to the arrival of a photon pair with PAS angles 
of cxa and as are given by 
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Here, we consider the variant of the Ekert protocol 
based on the Wigner inequality originally proposed in 
ref. 01 ■ For the analyzer settings the possible combined 
choices by Alice and Bob can be split into two groups: 
the first for key distribution and the second testing secu- 
rity. We assume Alice and Bob measure randomly among 
four combined analyzer settings. Alice's possible choices 
are a A = {a A .i = —k/6,o>a,2 — 0) and Bob's possible 
choices are a B = (as. 2 = 0, 0:5,3 = t/6). The key is ob- 
tained from the subset of measurements corresponding 
to parallel PAS settings (i.e. a A .i — otB.i — 0) and the 
firing detectors +a— b and — a+b- 

The Wigner inequality is based on the Wigner param- 
eter 

W = Pa AA ,c*B,2(+A, +b) + Pa A , 2 ,a B , 3 (+A, +b) 

-Pa AA ,a B A+A,+B)- (1) 



Note that for the maximally entangled states W = —1/8 
while for any local realistic theory W > 0. 

To obtain the Wigner inequality W > it is necessary 
to summarize the Wigner argument |l8j . Two assump- 
tions are stipulated in the proofs of the Wigner inequal- 
ity: locality and realism. Locality means that Alice's 
measurement results do not influence Bob's results, and 
vice versa. Realism means that, given any physical prop- 
erty its value exists independently of its observation or 
measurement. 

In the present case this is translated in terms of a clas- 
sical probability distribution, V(xi, x%\ y%, ys), where x\ 
and X2 are the hidden variables associated with the phys- 
ical property inducing Alice's measurement outcome in 
the presence of the PAS rotation angle a A ,i- Similarly 
?/2 and 1/3 correspond to the physical property inducing 
Bob's outcomes when PAS angle is set as 0:3,2 and 0:5,3. 
Thus, we can identify the possible values of 21,2 and 2/2,3 
with Alice and Bob's measurement outcomes, in other 
words xi, 2 = +a, —A and y 2 ,3 = +B> ~B- Following the 
Wigner approach we write, 

Pa A ,i,a B , 3 (+A,+B) = ^2 ^i+A, X 2 ;V2, +b) 

X2,V2 

= V(+ a ,+a;+b,+b)+V{+a,-a;-b,+b) 
+V{+a, +a; -b, +b) + V(+ A , -a; +b, +b). (2) 

In Wigner's original paper 0], 0,4,2 = 0:3,2 and 
V{xi,+A\+B,yz) = V(xi,-a\-b,V3) = 0. The as- 
sumption of perfect anticorrelation is obviously reason- 
able in the test of realism and locality of a physi- 
cal theory, because it reflects the classical counterpart 
of a quantum system prepared in the singlet state, 

i.e. Pa Ai2 ,u Bi2 { + A, +b) = Pa Ai2 ,a B A~A,-B) = 0. 

Thus, the inequality W > is obtained from Eq. 
@ by simply observing that V(+ A , — a] +b, +b) < 
Ex 2 V3 r P(+A,x 2 ;+B,y3) = P aA ,ua B , 2 (+A,+B) and 
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< T, X i, v V( x i>+A;y2,+B) = 



PotA,2,a B ,3, 

Ref.s [lj, [19j suggest to be cautious in applying 
Wigner's inequality to test the security of cryptogra- 
phy schemes, since authors are aware that the Wigner's 
inequality is derived assuming perfect anticorrelations, 
which are only approximately realized in practical situa- 
tions. Nevertheless a punctual quantification of the inse- 
curity induced by this assumption in the Ekert protocol 
based on Wigner's inequality has never been pointed out. 

In particular, after stating that the violation of the 
Wigner's inequality ascertains the security of the quan- 
tum channels, Ref. 13} suggests to replace the Wigner's 
inequality by the gene ralization of the Bell's inequality 
presented in Ref. [2(| for a substantial deviation from 
perfect anticorrelations. This last point has been over- 
looked by most readers probably because it is not clear 
what a " substantial deviation from the perfect anticorre- 
lations" is. 

When the eavesdropper, Eve, measures photons on ei- 
ther one or both of Alice's and Bob's channels, her pres- 
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ence might be expected to be revealed by a higher value 
of W than the local realistic theory limit, as it happens 
for the CHSH inequality Q. Unfortunately this is not 
the case. Even if it can be proved that, for Eve adopting 
intercept-resend strategy and detecting only one photon 
of the pair, the limit becomes Wove > 1/16, this is not 
for eavesdropping on both channels, because in this case 
there is no bound. 

A proof of this last assertion, according to ref. 0, 
can be obtained by considering Eve preparing each par- 



ticle of the pairs separately, so that each individual 
particle has a well defined polarization direction, pos- 
sibly varying from pair to pair. We write the prob- 
ability P($a,$b) of having Alice's particle in state 
\&a), and Bob's particle in state where $^ and 

$s are two angles of Eve's polarization preparation i.e. 

= cos$ z \H z ) + sin$ x \V g ). If the density oper- 
ator associated with Eve's pairs of photons is p GVC = 
J P(<S> A , $ B ) \$ a ) |$b) (*b| ($A|d$ A d$B, then 
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J P(<£a,$b) 



C0S 2 ($A + |)C0S 2 ($ B -|) 



I COS 2 $B + COS 2 $A COS 2 (<f>s 



d^^d^s. 



(3) 



In the case of single-channel eavesdropping with 
intercept-resend strategy, the anticorrelation between the 
two photons in the Eve measurement base is preserved 
because $b = ®A~ tt/2, and thus W eve > 1/16. In 
the most general case, when Eve has the total control 
over the state of individual particles, there is no physi- 
cal bound, as W eve results in some cases below the limit 
of local realistic theory, i.e. W eve < and surprisingly 
also below the quantum limit W eve < —1/8. For in- 
stance, if Eve gains total control of the source of pho- 
tons, she can send photons in proper polarization states 
to avoid disclosure by a security test by Alice and Bob, 
and for P($a, *b) = <5($ j4 -0.67r)(5($ s -0.47r) the value 
W eve = —0.1995 is below the quantum limit. 

In other words, the guarantee of Wigner's security test 
against eavesdropping strategies is limited only to the 
detection of one photon of the pairs while the CHSH 
security is independent from the adopted strategy Q ■ 

Therefore, we end up with a modified Wigner's 
parameter W suitable for QKD security test by 
removing from Wigner's original argument the anti- 
correlation assumption when ctA,2 = «b,2- Starting 



again from Eq. but rejecting the assumption 

Pa A ,2,a B ,2(+A, +b) = Pa A , 2 ,at B ,2(-A, ~b) = and ob- 
serving that V(+a, +a; +b, +b)+V(+a, -a; +b, +b) < 

Pa AA ,a B:2 ( + A,+B), V '(+ A, + A', - B , + b) < 

Pa A ,2,a B ,3(+A, +b) and V(+a, -a; -b, +b) < 
Pa A , 2 ,a B ,2(-A,-B), wc obtain 



W = P aAA ,a B:2 (+A,+B)+Po lA ,2,aB l s{+A,+B) (4) 
+Pa A , 2 ,a J , :2 (-A, — b) - PaA,i,os,s(+Ai +b) > 0. 

for any local realistic theory. 

We finally observe that for the singlet state we still 
obtain W = —1/8 also in this case. This result happens 
because the modified parameter W equals the original W 
except for the additional termp QA 2 . QB 2 (~A, ~b), which 
is zero in the case of singlet state. 

To demonstrate the robustness of this security test 
against an eavesdropping attack we perform a calcula- 
tion analogous to Eq. 



W eve = / P($a,*b) 



COS 2 (<I>A + f) COS 2 $s + COS 2 §A COS 2 ($ B ~ f ) 

sin 2 (^) sin 2 ($ B ) - cos 2 ($ A + 5) cos 2 ($ B - f ) 



d§A<i&B- 



Even in the general case when Eve has total control of 
the polarization states of photons in the two channels, we 
obtain that the minimum of W eV e — 0.04428, well above 
the limit for local realistic theory. This result is com- 
pletely equivalent to the one obtained with the security 
test based on the CHSH inequality ■ 

Some further analysis of W must be considered for 
the practical implementation of the Ekert protocol based 



on Wigner's inequality. According to ^j|> we highlight 
that the Ekert's protocol based on modified Wigner's in- 
equality still guarantees a simplification with respect to 
the one based on the CHSH inequality, because Alice 
and Bob randomly choose between two bases rather than 
three. Though the necessity of an experimental evalua- 
tion of the term p aA 2jCtB 2 (— a, — b) forces Alice and Bob 
to sacrifice part of the key for the sake of security. We 
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TABLE I: Distribution of data for Alice and Bob's analyzer 
settings ola,i, «a,2 and as, 2, as, 3 respectively. The dotted 
square is the original protocol of T. Jennewein, C. Simon, G. 
Weihs, H. Weinfurter and A. Zeilinger, Phys. Rev Lett. 84, 
4729 (2000). 

note that in any practical implementation of QKD pro- 
tocols, Alice and Bob distill from the noisy sifted key a 
nearly noise-free corrected key by means of error correc- 
tion procedures subjected to the constraint of knowing 
the quantum bit error rate (QBER). Also, the QBER is 
estimated at the cost of losing part of the key. Thus, 
we suggest using the same sacrificed part of the key to 
estimate both W and QBER. 

To compare the performances of the Ekert protocol 
based on Wigner's inequality versus the one CHSH-based 
we consider a protocol (Table I) where Alice and 
Bob measure randomly using three analyzer settings (as 
in the case of CHSH), where = <%b,i = — 7r/6, 

&a,2 = &b,2 = and 01,4,3 = as, 3 = n/6. W and W' 
correspond to two distinct test parameters and K to the 
key distribution. This protocol is more efficient than the 
protocol based on CHSH. In terms of key generation we 
observe that in the case of CHSH only 2/9 of the qubits 
exchanged are devoted to the key generation Q while in 
the case of our protocol this quantity is a number between 
2/9 and 1/3, depending on the security needs. 

Even if, for some strict security request, all the qubits 
exchanged by the two parties with analyzer settings 0,4,2, 
&b,2 are devoted to the evaluation of W (W'), and also 
for this protocol only 2/9 of the data still contribute to 
the key, in this protocol none of the qubits exchanged are 
discarded (Tabic I) while in the case of CHSH 1 /3 of the 
qubits are discarded. 

The results so far obtained allow us to quantify the 
so called " substantial deviation from prefect anticorrela- 
tions" as that value of the QBER such that the quantum 
key distribution fails, because the key is insecure even if 
the Wigner's inequality is violated. 

For the original protocol introduced in the QBER 
of the key is the probability of correlated results when 



analyzer settings are 0^,2,0^,2, i-e. 

QBER = PQ Ai2 ,a B , 2 (-A, ~b) + Pa A , 2 ,a B , 2 { + A, + b) ■ 

Thus, this leads to 

< W < W +p aA:2t a B:2 (-A,-B) +P«^,« B , 2 (-A, ~b), 

which can be easily rewritten in terms of QBER as 

QBER + W > 0. (5) 

Thanks to the modified Wigner's inequality a limit is 
found for both W and the anticorrelation check. Thus, 
for the Ekert's protocol based on the original Wigner's 
inequality a secure key distribution is provided when, in- 
stead of the violation of the Wigner's inequality (W > 0), 
the Wigner's parameter W satisfies W < —QBER. Eq. 
(JSJ) and the related considerations obviously still hold for 
the enlarged protocol presented in Table I. Here one has 
to consider only the QBER of that part of the key ob- 
tained with analyzers settings 0,4,2, 015,2, and not the 
QBER of the whole key. 

As a final remark we highlight that our approach not 
only solves the problem of estimating the " substantial de- 
viation from the perfect anticorrelations" but completely 
overtakes it. Following our approach the experimental- 
ist has simply to check the modified Wigner's inequality 
from his experimental data to guarantee non-locality, i.e. 
security of the quantum channels as in the original Ek- 
ert's idea Q, without any further anticorrelation check. 

Furthermore, the experimentalist in a noisy environ- 
ment can discard a secure key when Eq. (|SJ) is used in- 
stead of the modified Wigner's inequality, since W < 
W+QBER. 

In conclusion, this paper discusses the security of Ek- 
ert's protocol based on the Wigner inequality. We showed 
that the QKD Ekert protocol based on Wigner's inequal- 
ity presents a serious lack of security against some eaves- 
dropping strategies other than intercept-resend. We em- 
phasized the motivation beneath the missing security and 
propose a modified test ultimately guaranteeing secure 
QKD. 
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